CVE-2026-66390 Overview
CVE-2026-66390 is a Cross-Site Scripting (XSS) vulnerability in Apache Wicket, the component-based Java web application framework. The flaw stems from improper neutralization of input during web page generation [CWE-79]. It affects Apache Wicket versions 9.0.0 through 9.23.0 and 10.0.0 through 10.9.0. Attackers can inject malicious script content that executes in a victim's browser after the user interacts with a crafted link or page. The Apache Wicket project recommends upgrading to version 10.10.0, which resolves the issue.
Critical Impact
Successful exploitation allows attackers to execute arbitrary JavaScript in a victim's browser session, potentially leading to session hijacking, credential theft, or unauthorized actions performed on behalf of the authenticated user.
Affected Products
- Apache Wicket 9.0.0 through 9.23.0
- Apache Wicket 10.0.0 through 10.9.0
- Java web applications built on the affected Apache Wicket versions
Discovery Timeline
- 2026-07-27 - CVE-2026-66390 published to NVD
- 2026-07-28 - Last updated in NVD database
Technical Details for CVE-2026-66390
Vulnerability Analysis
CVE-2026-66390 is a reflected or stored Cross-Site Scripting flaw in Apache Wicket's web page generation logic. The framework fails to properly neutralize user-controlled input before rendering it into HTML output. When the affected component processes attacker-supplied data, that data reaches the response body without sufficient encoding or escaping.
Because exploitation requires user interaction and crosses a security scope boundary, an attacker typically delivers a crafted URL or form submission that the victim then triggers. The injected payload executes with the privileges of the victim's browser session on the vulnerable application's origin.
The issue is scoped to Apache Wicket branches 9.x and 10.x. Version 10.10.0 contains the corrective input handling. No fixed release is currently identified for the 9.x branch in the advisory; operators on 9.x should plan a migration path to 10.10.0 or later.
Root Cause
The root cause is improper output encoding in Wicket's page rendering pipeline. Untrusted input flows from a request parameter or a persisted field into the generated HTML without being escaped for the HTML context in which it appears. This is a classic instance of [CWE-79] where the framework's neutralization routine either misses a code path or fails against a specific input pattern.
Attack Vector
Exploitation occurs over the network with low complexity and requires no privileges, but does require user interaction. A typical attack chain includes:
- The attacker crafts a URL or input containing a JavaScript payload targeting an affected Wicket endpoint.
- The victim clicks the link or visits a page that reflects attacker-controlled content.
- Wicket renders the payload into the response without adequate HTML encoding.
- The browser executes the script within the origin of the vulnerable application.
Detailed technical discussion is available in the Apache Mailing List Thread and the OpenWall OSS-Security Update.
Detection Methods for CVE-2026-66390
Indicators of Compromise
- Web server access logs containing request parameters with <script>, javascript:, onerror=, or onload= tokens directed at Wicket endpoints.
- Unexpected outbound connections from user browsers to attacker-controlled domains shortly after a user visits an application page.
- Session tokens or authentication cookies being submitted to third-party hosts.
Detection Strategies
- Inventory all Java applications and identify Apache Wicket dependencies in versions 9.0.0–9.23.0 and 10.0.0–10.9.0 using software composition analysis (SCA) tooling.
- Deploy a web application firewall (WAF) rule set that flags reflected script-like payloads in query strings and form fields addressed to Wicket routes.
- Review application logs for anomalous URL parameters containing HTML control characters such as <, >, ", and ' in fields that normally accept alphanumeric input.
Monitoring Recommendations
- Monitor browser-side reporting endpoints, including Content Security Policy (CSP) violation reports, for script execution attempts on Wicket-rendered pages.
- Alert on user sessions where the User-Agent performs cross-origin requests to non-approved domains immediately after loading an application page.
- Correlate authentication events with unusual client-side activity to identify potential session hijacking following an XSS payload delivery.
How to Mitigate CVE-2026-66390
Immediate Actions Required
- Upgrade Apache Wicket to version 10.10.0 or later as recommended by the Apache Wicket project.
- Identify all internal and internet-facing applications built on affected Wicket versions and prioritize patching those exposed to untrusted users.
- Rotate session cookies and force re-authentication if you suspect exploitation attempts targeted authenticated users.
Patch Information
Users are recommended to upgrade to Apache Wicket 10.10.0, which fixes the issue. Applications on the 9.x branch should plan a migration to the fixed 10.x release. Refer to the Apache Mailing List Thread for the official announcement and the OpenWall OSS-Security Update for coordinated disclosure details.
Workarounds
- Deploy a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins, reducing the impact of injected payloads.
- Enable a WAF ruleset that blocks common XSS payload patterns on requests destined for Wicket endpoints until the upgrade is complete.
- Set the HttpOnly and Secure flags on session cookies to reduce the risk of cookie theft through script execution.
# Example Maven dependency update to the fixed Apache Wicket release
# pom.xml
# <dependency>
# <groupId>org.apache.wicket</groupId>
# <artifactId>wicket-core</artifactId>
# <version>10.10.0</version>
# </dependency>
mvn versions:set-property -Dproperty=wicket.version -DnewVersion=10.10.0
mvn clean verify
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
